Abnormal Communication Detection via Detector Allocation Rules
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional abnormal communication detection methods in networks, such as those used in vehicles and machine tools, suffer from over-detection issues due to the AND condition judgment of multiple detectors, leading to normal communication being incorrectly identified as abnormal.
Innovation Solution
An abnormal communication detection apparatus that includes a receiving part, a knowledge information acquiring part, an allocation rule generating part, and a plurality of detectors, which allocates communication data based on learned models to optimize detection accuracy, reducing over-detection by classifying communication data into groups based on temporal and payload characteristics and allocating them to the most accurate detectors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If multiple detectors are combined with AND condition judgment to improve detection accuracy, then the ability to detect abnormal communication is enhanced, but normal communication is easily misidentified as abnormal (over-detection)
Solution Approach 1:
The patent segments the detection system into multiple specialized detectors, each responsible for specific communication characteristics (ID, DLC, transmission cycle, payload). By dividing the detection function and assigning specialized detectors to different communication types based on allocation rules, the system reduces mutual interference and misjudgment between different communication patterns, thereby lowering over-detection while maintaining detection accuracy.
2Measurement precision
If all communication data is subjected to multiple detector judgments to ensure thorough detection, then detection coverage is improved, but processing time and system complexity increase
Solution Approach 1:
The patent applies local quality by creating allocation rules that match specific communication data characteristics to specific detectors. Instead of uniformly applying all detectors to all communication, the system assigns detectors locally based on communication type (e.g., control commands to safety-critical detectors, status data to efficiency detectors). This targeted approach maintains comprehensive detection coverage while reducing unnecessary processing and system complexity.
Data Source
AI summary
There is provided an abnormal communication detection apparatus capable of reducing over-detection. The abnormal communication detection apparatus includes: a receiving part receiving communication data for learning that includes an identifier and communication data for detection that includes the identifier; a knowledge information acquiring part acquiring knowledge information that is information about at least either temporal characteristics or payload characteristics of the communication data for learning; an allocation rule generating part generating allocation rules that are rules for specifying which communication data having which identifier is to be allocated to which detector among a plurality of detectors, based on the knowledge information; an allocating part allocating the communication data to any of the detectors based on the allocation rules; and the plurality of detectors each of which learns, when the communication data for learning is allocated, a model for detecting whether the communication data allocated to the detector is normal or abnormal, and detects, when the communication data for detection is allocated, whether the communication data for detection is normal or abnormal based on the learned model.